Illumination of a transistor can generate carriers, causing the transistor to conduct. This can be used to inject a fault into a flip-flop, for example to switch one or more bits in the SRAM (static random access memory) of a microcontroller. Such optical probing can be used to introduce errors in secure computations or protocols, and may provide a technique for attacking a secure microcontroller.
In order to protect flip-flops from optical attacks, several redundant flip-flop structures have been proposed, such as triple modular redundancy (see U.S. Pat. No. 7,482,831), dual interlock storage cell (see U.S. Pat. No. 7,661,046), built in soft error resilience (M. Zhang et. al, “Sequential element design with built in soft error resilience, IEEE Trans. VLSI Systems, Vol. 4, Issue 12, December 2006, pages 1368-1378), and radiation hardening by design master-slave flip-flop (see U.S. Pat. No. 7,719,304). Currently, processors for servers are implemented with some redundancy to guarantee reliability (D. Krueger et. al., “Circuit design for voltage scaling and SER immunity on a quad-core ITANIUM processor,” in Proc. ISSCC, February 2008, pp. 94-95). Redundancy for critical elements, such as a control flip-flop chain, may be necessary for designing smart and secure microcontrollers.
Conventional attack resistant redundant flip-flops have large area, high power overhead, and no mechanism for increased immunity to optical attack in each individual flip-flop. It is very hard to reduce the area penalty associated with redundant designs, because redundancy requires duplication of logical gates, resulting in additional transistors that inevitably increase area.
A flip-flop architecture with enhanced resistance to optical attack that reduces the area and/or power overhead associated with prior art designs is desired.